The security elements of the Parkerian Hexad are:

Possession or Control

Where do access controls (mandatory, discretionary and ACL) fit in?

  • Confidentiality and Control?
    – schroeder
    Commented Dec 2, 2015 at 15:34
  • 1
    I'd say control, with authentication (which is a prerequisite for DAC/MAC) in authenticity. I'd also niggle and say ACLs are an implementation of DAC in practice.
    – davecb
    Commented Dec 2, 2015 at 17:44

2 Answers 2


Looking back at the wikipedia page you linked to, I can see access control falling into the first bullet, confidentiality.

Quoting Wikipedia

Confidentiality refers to limits on who can get what kind of information. For example, executives concerned about protecting their enterprise’s strategic plans from competitors; individuals are concerned about unauthorized access to their financial records.

Access controls are exactly about who can get what kind of information.

In the comments below the answer, someone suggested it would be within authenticity and I was leaning towards that too but after reading what Wikipedia says, authenticity is more about proving that what you claim is true. Access control is about determining what it is you can do with that claim. Access control assumes that the claims are authentic.

If you go to the CIA triad definition of confidentiality, you will find the same approach as in the Parkerian hexad:

In information security, confidentiality "is the property, that information is not made available or disclosed to unauthorized individuals, entities, or processes" (Excerpt ISO27000).

So access controls (be it ACL, RBAC, or ABAC) belong to confidentiality.


Controls of any type are implementation mechanisms; the Parkerian Hexad are goals or assets. You would implement access controls to ensure that the set of potential actions affecting these goals are limited to only the set of actions that are explicitly permitted.

Access controls are an answer to the question:

  • What have you done to ensure that the system continues to protect information confidentiality? (I have implemented access controls to ensure that only people in group A have access to information in group A)
  • What have you done to ensure that the system continues to protect possession? (I have implemented a locking cable that ties the system to a desktop; only individuals authorized to move the system have a key)
  • What have you done to protect information integrity? (Data in group A is protected by a hash which is verified once/hour by an offsite mechanism) (I have executed an extensive business process model that identifies the required operations, all of the required operations and only the required operations and I have implemented a permission model that matches the business process model)
  • What have you done to ensure authenticity? (We have access controls that prevent business processes from acting on information that has not been signed by a trusted certification agent.)
  • What have you done to protect information availability? (We have access controls that limit the user's ability to use the system to less than 10% of the available resources/user. )
  • what have you done to ensure utility? (We have access controls that prohibit the user from taking actions that are likely to degrade the utility of the system... )

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .